Login Request a demo
High severity · published Oct 29, 2026
CVE-2026-114148
ASP.NET Core Elevation of Privilege Vulnerability
New
7.8
CVSS
–
EPSS
No
On KEV
Description
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
N1
.NET 10.0 installed on Linux · Microsoft
10.0.0 before 10.0.403 · source: vendor
N1
.NET 10.0 installed on Mac OS · Microsoft
10.0.0 before 10.0.403 · source: vendor
N1
.NET 10.0 installed on Windows · Microsoft
10.0.0 before 10.0.403 · source: vendor
N1
.NET 11.0 installed on Linux · Microsoft
11.0.0-preview.1 before 11.0.100-rc.3 · source: vendor
N1
.NET 11.0 installed on Mac OS · Microsoft
11.0.0-preview.1 before 11.0.100-rc.3 · source: vendor
N1
.NET 11.0 installed on Windows · Microsoft
11.0.0-preview.1 before 11.0.100-rc.3 · source: vendor
N8
.NET 8.0 installed on Linux · Microsoft
8.0.0 before 8.0.427 · source: vendor
N8
.NET 8.0 installed on Mac OS · Microsoft
8.0.0 before 8.0.427 · source: vendor
N8
.NET 8.0 installed on Windows · Microsoft
8.0.0 before 8.0.427 · source: vendor
N9
.NET 9.0 installed on Linux · Microsoft
9.0.0 before 9.0.320 · source: vendor
N9
.NET 9.0 installed on Mac OS · Microsoft
9.0.0 before 9.0.320 · source: vendor
N9
.NET 9.0 installed on Windows · Microsoft
9.0.0 before 9.0.320 · source: vendor
Affected product
N1
.NET 10.0 installed on Linux
Microsoft
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114148
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114148
vendor-advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148
More from .NET 10.0 installed on Linux
8.8
CVE-2026-102870
ASP.NET Core Remote Code Execution Vulnerability
8.1
CVE-2026-70197
.NET and Visual Studio Remote Code Execution Vulnerability